I guess we can use T16 for DDOS from external sources.
This ticket an attempt to contain damage by compromised workstations from ddos'ing the control port filter. Even if solved, still Tor could be ddos'ed. So I suggest to defer this ticket for a later release. The we perhaps solve it by using iptables as a limiter.